platformforge 0.1.0__py3-none-any.whl

platformforge/evals/coverage.py

@@ -0,0 +1,140 @@
+"""§122 rule coverage report + §127 false-positive measurement.
+
+Coverage: which eval variants exercise each catalog rule.
+Precision: cases carrying `expect.rules_not_fired` measure whether a rule
+fires where it shouldn't — precision = rules that stayed silent on
+negative/boundary fixtures / total negative+boundary observations.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from platformforge.evals.runner import CASES_DIR, _catalog, _facts_for, _fired_ids
+from platformforge.lab.runner import SCENARIOS_DIR
+
+VARIANTS = ("positive", "negative", "boundary", "unresolved", "version")
+
+
+def _case_docs(cases_dir: Path) -> list[tuple[Path, dict]]:
+    out = []
+    for c in sorted(cases_dir.glob("*/case.yaml")) if cases_dir.is_dir() \
+            else []:
+        doc = yaml.safe_load(c.read_text()) or {}
+        out.append((c.parent, doc))
+    return out
+
+
+def _lab_docs(scenarios_dir: Path) -> list[tuple[Path, dict]]:
+    out = []
+    for e in sorted(scenarios_dir.glob("*/expected.yaml")) \
+            if scenarios_dir.is_dir() else []:
+        doc = yaml.safe_load(e.read_text()) or {}
+        out.append((e.parent, doc))
+    return out
+
+
+def _rules_of(case: dict) -> dict[str, list[str]]:
+    """Every rule a case exercises, keyed by expectation polarity."""
+    exp = case.get("expect", {})
+    return {"positive": list(exp.get("rules_fired", [])),
+            "negative": list(exp.get("rules_not_fired", [])),
+            "version": (list(exp.get("unresolved", []))
+                        + [next(iter(w)) if isinstance(w, dict) else w
+                           for w in exp.get("rules_skipped", [])]
+                        + list(exp.get("passed", [])))}
+
+
+def _lab_rules_of(doc: dict) -> dict[str, list[str]]:
+    """A lab scenario covers every rule it asserts on."""
+    return {"positive": list(doc.get("violated_rules", [])),
+            "negative": list(doc.get("absent_rules", []))}
+
+
+def rule_coverage(cases_dir: str | Path = CASES_DIR,
+                  scenarios_dir: str | Path = SCENARIOS_DIR) \
+        -> dict[str, Any]:
+    """rule_id → {variant: [cases]}. Eval cases AND lab scenarios count —
+    a rule asserted by a lab `violated_rules` is covered-positive; by
+    `absent_rules`, covered-negative. Uncovered rules are named."""
+    catalog = _catalog()
+    matrix: dict[str, dict[str, list[str]]] = {
+        r.rule_id: {v: [] for v in VARIANTS} for r in catalog}
+    for cdir, case in _case_docs(Path(cases_dir)):
+        cid = case.get("id", cdir.name)
+        variant = case.get("variant")
+        for rid, polarity in _rules_of(case).items():
+            for r in polarity:
+                if r in matrix:
+                    if variant in VARIANTS:
+                        matrix[r][variant].append(cid)
+                    elif polarity in VARIANTS:
+                        matrix[r][polarity].append(cid)
+                    else:
+                        matrix[r]["positive"].append(cid)
+    for sdir, doc in _lab_docs(Path(scenarios_dir)):
+        sid = f"lab/{sdir.name}"
+        for polarity, rules in _lab_rules_of(doc).items():
+            for r in rules:
+                if r in matrix:
+                    matrix[r][polarity].append(sid)
+    rows = []
+    for rid in sorted(matrix):
+        cov = matrix[rid]
+        rows.append({"rule_id": rid,
+                     **{v: bool(cov.get(v)) for v in VARIANTS},
+                     "cases": sum(len(v) for v in cov.values())})
+    covered = [r for r in rows if r["cases"] > 0]
+    return {"coverage": rows,
+            "counts": {"rules": len(rows), "with_cases": len(covered),
+                       "uncovered": sorted(r["rule_id"] for r in rows
+                                           if r["cases"] == 0)},
+            "note": "coverage = a case or lab scenario names the rule; "
+                    "it is not a correctness proof"}
+
+
+def precision_report(cases_dir: str | Path = CASES_DIR) -> dict[str, Any]:
+    """§127 — run every case, measure per-rule false-positive rate.
+
+    A false positive = a rule fires on a negative/boundary case that lists
+    it under `rules_not_fired`. Reported per rule and in aggregate."""
+    per_rule: dict[str, dict[str, int]] = {}
+    details = []
+    for cdir, case in _case_docs(Path(cases_dir)):
+        not_fired = set(case.get("expect", {}).get("rules_not_fired", []))
+        if not not_fired:
+            continue
+        try:
+            fired = _fired_ids(_facts_for(case, cdir),
+                               case.get("versions"))
+        except Exception as exc:  # noqa: BLE001 — case error ≠ FP
+            details.append({"case": cdir.name, "error": str(exc)})
+            continue
+        fps = not_fired & fired
+        for rid in not_fired:
+            d = per_rule.setdefault(rid, {"fp": 0, "checks": 0})
+            d["checks"] += 1
+            d["fp"] += int(rid in fps)
+        if fps:
+            details.append({"case": cdir.name,
+                            "false_positives": sorted(fps)})
+    rows = []
+    for rid, d in sorted(per_rule.items()):
+        rows.append({"rule_id": rid, "false_positives": d["fp"],
+                     "negative_checks": d["checks"],
+                     "precision": round(1 - d["fp"] / d["checks"], 4)
+                     if d["checks"] else None})
+    total_fp = sum(r["false_positives"] for r in rows)
+    total_checks = sum(r["negative_checks"] for r in rows)
+    return {"precision": rows,
+            "aggregate_precision": round(1 - total_fp / total_checks, 4)
+            if total_checks else None,
+            "details": details,
+            "counts": {"rules_measured": len(rows),
+                       "negative_checks": total_checks,
+                       "false_positives": total_fp},
+            "note": "precision measured on negative/boundary cases only; "
+                    "no negative corpus → no precision claim"}

platformforge/evals/fleet_invariants.py

@@ -0,0 +1,260 @@
+"""Cycle 5 Phase N — fleet/analytics invariant probes (§286–292).
+
+Deterministic functions returning {"ok": bool, "detail": ...}. Each
+probe encodes one spec invariant that scripted lab scenarios can't
+reach: unknown-handling, provenance, small-sample honesty, boundary
+conditions (correlation≠causality, centrality≠criticality,
+low-util≠deletable, uncertain optimization never auto-promoted).
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def probe_partial_coverage_visible(tmp) -> dict[str, Any]:
+    """§286 — a permission-limited member is still reported; coverage
+    stays <1 and the member is never silently dropped."""
+    from platformforge.fleet.models import FleetSnapshot, MemberObservation
+    snap = FleetSnapshot(
+        fleet_id="f",
+        member_observations=[
+            MemberObservation(member_id="cluster:a", status="observed",
+                              coverage=1.0),
+            MemberObservation(member_id="cluster:b",
+                              status="permission-limited",
+                              coverage=0.3)])
+    d = snap.to_dict()
+    ok = snap.coverage < 1.0 and \
+        any(o.member_id == "cluster:b"
+            for o in snap.member_observations) and \
+        d.get("coverage") is not None
+    return {"ok": ok, "detail": f"coverage={snap.coverage}"}
+
+
+def probe_small_sample_confidence(tmp) -> dict[str, Any]:
+    """§288 — small samples never produce high confidence; the engine
+    reports insufficient-history below the minimum support."""
+    from datetime import datetime, timezone
+
+    from platformforge.analytics.history import HistoryEngine
+    eng = HistoryEngine()
+    eng.ingest_events("incident", [
+        {"ts": datetime.now(timezone.utc).isoformat(),
+         "subject": "svc:s1", "type": "incident"}], "t")
+    pats = eng.patterns("90d")
+    ok = not pats or all(p.confidence != "high" for p in pats)
+    # a single event must never reach `high`
+    return {"ok": ok,
+            "detail": f"patterns={len(pats)} "
+                      f"conf={[p.confidence for p in pats]}"}
+
+
+def probe_absent_allocation_unknown(tmp) -> dict[str, Any]:
+    """§289 — cost with no allocation data reports unallocated/unknown,
+    never a fabricated zero."""
+    from platformforge.analytics.finops_v4 import cost_hierarchy
+    h = cost_hierarchy([])
+    ok = h.get("total", -1) == 0 or "unallocated" in h
+    # a doc with amounts but no allocation keys keeps them visible
+    h2 = cost_hierarchy([{"amount": 500}])
+    ok = ok and h2.get("unallocated", 0) >= 1
+    return {"ok": ok, "detail": h2}
+
+
+def probe_centrality_not_criticality(tmp) -> dict[str, Any]:
+    """§290 — blast concentration never *assigns* criticality; a
+    high-centrality node without declared criticality stays None and
+    the entry carries the explicit disclaimer."""
+    from platformforge.analytics.reliability import blast_concentration
+    from platformforge.graph.model import Edge, Graph, Node
+    g = Graph()
+    for n in ("a", "b", "c", "d"):
+        g.add_node(Node.make("service", n))
+    for s, d in (("a", "b"), ("a", "c"), ("a", "d")):
+        g.add_edge(Edge(f"service/{s}", f"service/{d}", "depends_on"))
+    conc = blast_concentration(g)
+    top = conc[0] if conc else {}
+    ok = bool(conc) and top.get("declared_criticality") is None and \
+        "criticality" in top.get("note", "") and \
+        all("in_degree" in e for e in conc)
+    return {"ok": ok, "detail": conc}
+
+
+def probe_low_util_not_deletable(tmp) -> dict[str, Any]:
+    """§290 — idle/underused resources are never marked deletable."""
+    from platformforge.analytics.finops_v4 import idle_resources
+    idle = idle_resources([
+        {"id": "vm:1", "requests_30d": 0, "cpu_util": 1,
+         "attached": True, "cost_monthly": 100},
+        {"id": "vol:2", "orphaned": True, "attached": False,
+         "cpu_util": 0, "cost_monthly": 50}])
+    ok = bool(idle) and not any(i.get("deletable") for i in idle)
+    return {"ok": ok, "detail": idle}
+
+
+def probe_correlation_not_causality(tmp) -> dict[str, Any]:
+    """§291 — repeated co-occurrence produces a hypothesis with
+    limitations, never a causal claim."""
+    from datetime import datetime, timedelta, timezone
+
+    from platformforge.analytics.history import HistoryEngine
+    eng = HistoryEngine()
+    now = datetime.now(timezone.utc)
+    evs = [{"ts": (now - timedelta(days=i)).isoformat(),
+            "subject": "svc:s", "type": "incident"}
+           for i in range(1, 6)]
+    eng.ingest_events("incident", evs, "t")
+    pats = eng.patterns("90d")
+    d = pats[0].to_dict() if pats else {}
+    ok = bool(pats) and not d.get("causal_claim", True) and \
+        bool(d.get("limitations"))
+    return {"ok": ok, "detail": d}
+
+
+def probe_uncertain_optimization_suppressed(tmp) -> dict[str, Any]:
+    """§292 — high-uncertainty opportunities never promote to recs."""
+    from platformforge.optimize.engine import OptimizationEngine
+    from platformforge.optimize.models import OptimizationOpportunity
+    eng = OptimizationEngine()
+    eng.add_opportunity(OptimizationOpportunity(
+        opportunity_id="o1", type="cost", scope={"svc": "s"},
+        evidence=[], uncertainty="high"))
+    eng.add_opportunity(OptimizationOpportunity(
+        opportunity_id="o2", type="cost", scope={"svc": "s2"},
+        evidence=[{"fact_id": "f1"}], uncertainty="low"))
+    recs = eng.recommendations()
+    ok = len(recs) == 1 and recs[0].recommendation_id.endswith("o2")
+    return {"ok": ok, "detail": [r.recommendation_id for r in recs]}
+
+
+def probe_plan_changeintent_only(tmp) -> dict[str, Any]:
+    """§303 — plan() returns a ChangeIntent; no path to envelope."""
+    from platformforge.ops.models import ChangeIntent
+    from platformforge.optimize.engine import OptimizationEngine
+    from platformforge.optimize.models import OptimizationRecommendation
+    rec = OptimizationRecommendation(
+        recommendation_id="r1", type="cost", scope={"svc": "s"},
+        confidence="low")
+    ci = OptimizationEngine.plan(rec)
+    ok = isinstance(ci, ChangeIntent) and \
+        ci.reason.type == "recommendation"
+    return {"ok": ok, "detail": ci.reason.type}
+
+
+def probe_missing_denominator(tmp) -> dict[str, Any]:
+    """§195/§361 — cost/token is absent without an observed token
+    count; the metric is never fabricated."""
+    from platformforge.aiplat.models import ai_unit_economics
+    ue = ai_unit_economics(9800, tokens=None)
+    ok = "cost_per_1m_tokens" not in ue and ue.get("cost") == 9800
+    return {"ok": ok, "detail": ue}
+
+
+def probe_federation_secret_denied(tmp) -> dict[str, Any]:
+    """§302 — export_summary denies any payload containing a secret,
+    regardless of classification."""
+    from platformforge.federation.node import NodeManifest, export_summary
+    node = NodeManifest(node_id="n", capabilities=["fleet"])
+    for cls in ("public", "internal"):
+        s = export_summary(node, {"api_key": "AKIAIOSFODNN7EXAMPLE"},
+                           cls)
+        if s.get("action") != "deny":
+            return {"ok": False, "detail": f"{cls} leaked: {s}"}
+    return {"ok": True, "detail": "secrets denied at all tiers"}
+
+
+def probe_federation_restricted_denied(tmp) -> dict[str, Any]:
+    """§302 — restricted classification is denied by default."""
+    from platformforge.federation.node import NodeManifest, export_summary
+    node = NodeManifest(node_id="n", capabilities=["fleet"])
+    s = export_summary(node, {"details": "pii-ish"}, "restricted")
+    return {"ok": s.get("action") == "deny", "detail": s}
+
+
+def probe_member_key_deterministic(tmp) -> dict[str, Any]:
+    """§296 — fleet member identity is deterministic across runs."""
+    from platformforge.fleet.models import member_key
+    a = member_key("cluster", "prod-1")
+    b = member_key("cluster", "prod-1")
+    c = member_key("cluster", "prod-2")
+    return {"ok": a == b and a != c, "detail": a}
+
+
+def probe_dx_no_person_metrics(tmp) -> dict[str, Any]:
+    """§287 — DX metrics never carry per-person/individual fields."""
+    from platformforge.analytics.dx import dx_metrics, guard_no_person_metrics
+    m = dx_metrics([
+        {"path": "web", "requested_at": "2025-11-01T09:00:00Z",
+         "ready_at": "2025-11-01T09:30:00Z", "status": "provisioned",
+         "approval_wait_s": 300},
+        {"path": "web", "requested_at": "2025-11-02T09:00:00Z",
+         "ready_at": "2025-11-02T09:20:00Z", "status": "provisioned"}])
+    bad = guard_no_person_metrics(m)
+    return {"ok": not bad and m.get("scope", "").startswith("team"),
+            "detail": f"violations={bad}"}
+
+
+def probe_history_window_deterministic(tmp) -> dict[str, Any]:
+    """§298 — identical events + window → identical patterns."""
+    from datetime import datetime, timedelta, timezone
+
+    from platformforge.analytics.history import HistoryEngine
+    now = datetime.now(timezone.utc)
+    evs = [{"ts": (now - timedelta(days=i)).isoformat(),
+            "subject": "svc:s", "type": "incident"}
+           for i in range(1, 4)]
+    outs = []
+    for _ in range(2):
+        eng = HistoryEngine()
+        eng.ingest_events("incident", evs, "t")
+        outs.append([p.to_dict() for p in eng.patterns("90d")])
+    return {"ok": outs[0] == outs[1],
+            "detail": f"runs_equal={outs[0] == outs[1]}"}
+
+
+PROBES = {
+    "partial-coverage-visible": probe_partial_coverage_visible,
+    "small-sample-confidence": probe_small_sample_confidence,
+    "absent-allocation-unknown": probe_absent_allocation_unknown,
+    "centrality-not-criticality": probe_centrality_not_criticality,
+    "low-util-not-deletable": probe_low_util_not_deletable,
+    "correlation-not-causality": probe_correlation_not_causality,
+    "uncertain-optimization-suppressed":
+        probe_uncertain_optimization_suppressed,
+    "plan-changeintent-only": probe_plan_changeintent_only,
+    "missing-denominator": probe_missing_denominator,
+    "federation-secret-denied": probe_federation_secret_denied,
+    "federation-restricted-denied": probe_federation_restricted_denied,
+    "member-key-deterministic": probe_member_key_deterministic,
+    "dx-no-person-metrics": probe_dx_no_person_metrics,
+    "history-window-deterministic": probe_history_window_deterministic,
+}
+
+
+def probe_fleet_report_all_cited(tmp) -> dict[str, Any]:
+    """Every invest_next entry in a fleet report must carry evidence;
+    suppressed opportunities stay visible; coverage bounds the verdict."""
+    import argparse
+    import tempfile
+    from pathlib import Path
+
+    from platformforge.cli.fleetcmd import cmd_fleet
+    src = Path("lab/fleets/acme")
+    with tempfile.TemporaryDirectory() as td:
+        for f in src.glob("*.yaml"):
+            (Path(td) / f.name).write_text(f.read_text())
+        ns = argparse.Namespace(fleet_cmd="report", path=td, question="",
+                                window="", limit=5, id="", out="",
+                                format="json")
+        r = cmd_fleet(ns)
+    inv = r.get("invest_next", [])
+    cited = all(i.get("evidence") for i in inv)
+    return {"ok": bool(inv) and cited
+            and r.get("portfolio", {}).get("suppressed", 0) > 0
+            and r.get("coverage", {}).get("min_member", 1) < 1,
+            "detail": {"invest": len(inv), "all_cited": cited,
+                       "suppressed": r.get("portfolio", {}).get("suppressed")}}
+
+
+PROBES["fleet-report-all-cited"] = probe_fleet_report_all_cited

platformforge/evals/ops_invariants.py

@@ -0,0 +1,158 @@
+"""Cycle 4.1 — ops invariant probes for eval cases (§137–141).
+
+Each probe is a deterministic function returning {"ok": bool,
+"detail": ...} — the eval runner records pass/fail from `ok`. These
+cover the correctness invariants that a scripted lab scenario can't
+reach: tamper detection, refusal codes, builder semantics.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+
+
+def probe_material_tamper(tmp) -> dict[str, Any]:
+    """§141 — a RollbackMaterial whose file content is tampered is
+    detected by its content hash; the store refuses a mismatched
+    write."""
+    from pathlib import Path
+
+    from platformforge.ops.material import MaterialStore, capture_material
+    store = MaterialStore(root=Path(tmp) / "materials")
+    m = capture_material("kubernetes.scale", "s1", "op-t",
+                         {"replicas": 5}, {"replicas"},
+                         pre_state={"replicas": 3})
+    store.put(m)
+    path = Path(tmp) / "materials" / f"{m.hash().split(':', 1)[1]}.json"
+    blob = json.loads(path.read_text())
+    blob["pre_state"]["replicas"] = 999          # tamper
+    recomputed = type(m).from_dict(blob).hash()
+    ok = recomputed != m.hash()
+    return {"ok": ok, "detail": "tampered material hash "
+            f"{recomputed[:24]} != {m.hash()[:24]}"}
+
+
+def probe_approval_seal_tamper(tmp) -> dict[str, Any]:
+    """§140 — modifying a sealed approval invalidates the seal and the
+    approval no longer passes check_approval."""
+    from platformforge.ops.approval import Approval, check_approval
+    ap = Approval(approval_id="a1", subject_hash="sha256:plan",
+                  scope=["r1"], actor="alice", role="owner")
+    ap.seal()
+    assert ap.integrity_seal_valid()
+    ap.scope = ["r1", "everything-else"]       # tamper after seal
+    ok = not ap.integrity_seal_valid()
+    chk = check_approval([ap], subject_hash="sha256:plan",
+                         scope=["r1"], current_plan_hash="sha256:plan")
+    refused = (chk.refusal or {}).get("refusal") == \
+        "PF-OPS-APPROVAL-TAMPERED"
+    return {"ok": ok and refused,
+            "detail": f"seal_valid={not ok} refusal={refused}"}
+
+
+def probe_no_delta(tmp) -> dict[str, Any]:
+    """§138 — a mutating plan with no ExpectedDelta refuses to mint."""
+    from platformforge.ops.engine import mint_envelope
+    from platformforge.ops.engine import plan as mkplan
+    from platformforge.ops.models import ChangeIntent, ExpectedDelta, PlanStep, Reason
+    from platformforge.ops.policy import PolicyDecision
+    intent = ChangeIntent(intent_id="i", reason=Reason(type="manual"),
+                          target_resources=["r"])
+    plan = mkplan(intent, steps=[PlanStep(
+        step_id="s", action="kubernetes.scale",
+        params={"kind": "Deployment", "name": "w", "replicas": 5})],
+        expected_delta=ExpectedDelta())
+    r = mint_envelope(plan, execution_id="x",
+                      decisions=[PolicyDecision(policy_id="p",
+                                                decision="allow",
+                                                reason="")],
+                      approvals=[], risk={}, rollback=None)
+    ok = isinstance(r, dict) and r.get("refusal") == "PF-OPS-NO-DELTA"
+    return {"ok": ok, "detail": r if not ok else "refused as designed"}
+
+
+def probe_sot_conflict(tmp) -> dict[str, Any]:
+    """§139 — gitops + terraform both claiming the resource →
+    conflicted status requiring human review, never silent winner."""
+    from platformforge.ops.source_of_truth import resolve
+    res = resolve([{"resource": "k8s:x/y/Deployment/z",
+                    "declared_by": "terraform",
+                    "managed_by": "argocd"}],
+                  {"rules": [{"when": "multi-owner",
+                              "status": "conflicted"}]})
+    d = [r.to_dict() for r in res]
+    conflicted = any(r.get("status") in ("conflicted", "unresolved")
+                     or not r.get("resolved", True) for r in d)
+    return {"ok": bool(d) and conflicted,
+            "detail": d}
+
+
+def probe_plan_reuse(tmp) -> dict[str, Any]:
+    """§15–19 — the same terraform saved plan can never be reused as
+    its own rollback."""
+    from platformforge.ops.rollback import terraform_plan_reuse_check
+    r = terraform_plan_reuse_check("sha256:planA", "sha256:planA")
+    return {"ok": r.get("refusal") == "PF-OPS-PLAN-REUSE",
+            "detail": r}
+
+
+def probe_blind_inverse_refused(tmp) -> dict[str, Any]:
+    """§6–9 — without captured material the plan is unresolved, never
+    executable-by-guess."""
+    from platformforge.ops.rollback import build_rollback_plan
+    rb = build_rollback_plan(
+        [{"step_id": "s", "action": "kubernetes.scale",
+          "params": {"replicas": 5}}], materials={})
+    return {"ok": rb.status in ("unresolved", "manual-only",
+                                "impossible") and
+            rb.status != "executable",
+            "detail": f"status={rb.status}"}
+
+
+def probe_git_revert_builder(tmp) -> dict[str, Any]:
+    """§137 — git.commit material → git revert of the RESULTING commit
+    (post-state), not a blind `git reset`."""
+    from platformforge.ops.material import capture_material
+    from platformforge.ops.rollback_builders import BUILDERS
+    m = capture_material("git.commit", "s", "op", {"repo": "r"},
+                         {"pre_change_commit"},
+                         pre_state={"pre_change_commit": "aaa"},
+                         execution_result={"resulting_commit": "bbb"})
+    b = BUILDERS["git.commit"]({"repo": "r"}, m.to_dict(), {})
+    ok = b is not None and b["action"] == "git.revert_commit" and \
+        b["params"].get("commit_sha") == "bbb" and \
+        "aaa" not in json.dumps(b["params"])
+    return {"ok": ok, "detail": b}
+
+
+def probe_rollback_unknown(tmp) -> dict[str, Any]:
+    """§137 rollback-unknown — an action with no builder and no
+    declared strategy stays unresolved."""
+    from platformforge.ops.material import capture_material
+    from platformforge.ops.rollback import build_rollback_plan
+    m = capture_material("kubernetes.rollout_restart", "s", "op",
+                         {"kind": "Deployment", "name": "w"},
+                         {"revision"})
+    rb = build_rollback_plan(
+        [{"step_id": "s", "action": "kubernetes.rollout_restart",
+          "params": {}}],
+        materials={"s": m}, context={})
+    ok = rb.status in ("unresolved", "requires-replan",
+                       "manual-only") or (
+        rb.status == "executable" and rb.actions)
+    # without a captured revision the plan must NOT be executable
+    return {"ok": ok and rb.status != "executable",
+            "detail": f"status={rb.status} actions={rb.actions}"}
+
+
+PROBES = {
+    "material-tamper": probe_material_tamper,
+    "approval-seal-tamper": probe_approval_seal_tamper,
+    "no-delta": probe_no_delta,
+    "sot-conflict": probe_sot_conflict,
+    "plan-reuse": probe_plan_reuse,
+    "blind-inverse-refused": probe_blind_inverse_refused,
+    "git-revert-builder": probe_git_revert_builder,
+    "rollback-unknown": probe_rollback_unknown,
+}